Free QA Skills for AI Coding Agents
Tools and licenses · QualityMax ecosystem
No QualityMax account is required. Your chosen coding agent and any external tools determine model costs and data handling.
Quick QA, accessibility, performance, security, SEO, privacy, and test-review skills for any website or codebase. No signup or API keys required. The web skills use browser automation such as Playwright MCP; the code-review skills work directly with local repository files and need no MCP at all.
Use these skills when you need a fast audit for Core Web Vitals, WCAG accessibility, broken links, responsive screenshots, console errors, security headers, cookies and trackers, mixed content, multi-ecosystem dependency and runtime risk, leaked secrets, flaky selectors, weak generated tests, dead code, API security, Railway exposure, IaC misconfigurations, LLM/agent app risk, naughty-string handling, wrongly rejected names and emails, invisible Unicode (Trojan Source), exploited-CVE monitoring, advisory triage, or a unified evidence-backed security audit.
Skill directories: skills.sh, Smithery, and SkillMD.
Install
GitHub Agent Skills
Install all 36 skills with the GitHub CLI:
gh skill install Quality-Max/free-qa-skills
Install one skill and pin it to the current release:
gh skill install Quality-Max/free-qa-skills accessibility-check --pin v1.0.0
See the latest GitHub Agent Skills release.
skills.sh
Install from skills.sh with the official skills CLI. This records the install correctly for the public skills directory.
# Install all 36 QA skills
npx skills add Quality-Max/free-qa-skills
# Or install one focused skill
npx skills add Quality-Max/free-qa-skills/accessibility-check
npx skills add Quality-Max/free-qa-skills/core-web-vitals
npx skills add Quality-Max/free-qa-skills/diff-risk-review
npx skills add Quality-Max/free-qa-skills/security-audit
npx skills add Quality-Max/free-qa-skills/exploited-vulnerability-watch
Then use the skill in your coding agent:
/accessibility-check https://mysite.com
/core-web-vitals https://mysite.com
/diff-risk-review
/security-audit
/exploited-vulnerability-watch
Manual copying still works for local development, but npx skills add is the recommended install path because it keeps the skills visible on skills.sh.
Skills
36 diagnostic skills across six areas. They find problems and grade them, they don't change your code or site. The two naughty-string test skills submit test cases to live forms, so point them at a test or staging environment.
Web quality (browser automation)
| Skill | What It Checks | Install |
|---|
| ui-ux-scan | Touch targets, font consistency, spacing, empty states, visual hierarchy, UX anti-patterns | npx skills add Quality-Max/free-qa-skills/ui-ux-scan |
| accessibility-check | WCAG violations — alt text, headings, keyboard nav, ARIA, contrast | npx skills add Quality-Max/free-qa-skills/accessibility-check |
| responsive-screenshots | Screenshot at 5 viewports (mobile → ultrawide), flag layout breaks | npx skills add Quality-Max/free-qa-skills/responsive-screenshots |
| broken-link-scan | Find 404s, redirect chains, dead links | npx skills add Quality-Max/free-qa-skills/broken-link-scan |
| console-error-scan | JS errors, failed network requests, deprecation warnings | npx skills add Quality-Max/free-qa-skills/console-error-scan |
| seo-check | Meta tags, Open Graph, structured data, image alts, heading hierarchy | npx skills add Quality-Max/free-qa-skills/seo-check |
| security-headers-check | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — graded A–F | npx skills add Quality-Max/free-qa-skills/security-headers-check |
| cookie-privacy-scan | Cookie inventory, missing Secure/HttpOnly/SameSite, third-party trackers, pre-consent tracking (GDPR) | npx skills add Quality-Max/free-qa-skills/cookie-privacy-scan |
| form-validation-scan | Required-field enforcement, format validation, error messaging, accepts-bad-input probing | npx skills add Quality-Max/free-qa-skills/form-validation-scan |
| i18n-rtl-audit | Layout breaks under long translations, RTL rendering, hardcoded strings, missing lang/dir | npx skills add Quality-Max/free-qa-skills/i18n-rtl-audit |
| mixed-content-scan | HTTP scripts/styles/images/iframes and insecure form actions on HTTPS pages — active vs passive | npx skills add Quality-Max/free-qa-skills/mixed-content-scan |
Performance (browser automation)
| Skill | What It Checks | Install |
|---|
| core-web-vitals | LCP, CLS, INP, TTFB, FCP via browser perf APIs — graded against Google thresholds | npx skills add Quality-Max/free-qa-skills/core-web-vitals |
| page-weight-budget | Total bytes, request count, render-blocking JS/CSS, oversized/uncompressed images vs a budget | npx skills add Quality-Max/free-qa-skills/page-weight-budget |
| third-party-bloat | Third-party scripts (analytics, tags, chat, ads) ranked by transfer size + main-thread cost | npx skills add Quality-Max/free-qa-skills/third-party-bloat |
| cold-load-waterfall | Cold-cache load profile — TTFB, time-to-interactive, longest-pole requests, text waterfall | npx skills add Quality-Max/free-qa-skills/cold-load-waterfall |
Code review (local repository — no MCP)
| Skill | What It Checks | Install |
|---|
| evidence-code-audit | Broad, focused, or incremental audit with traced failure paths, severity/confidence, coverage limits, and fix priorities | npx skills add Quality-Max/free-qa-skills/evidence-code-audit |
| diff-risk-review | Reviews git diff for correctness/security/performance — severity-ranked with file:line | npx skills add Quality-Max/free-qa-skills/diff-risk-review |
| secret-scan | Hardcoded API keys, tokens, private keys, connection strings across common providers | npx skills add Quality-Max/free-qa-skills/secret-scan |
| dependency-audit | Vulnerable or unsupported packages and runtimes, stale locks, unsafe ranges, and supply-chain risk across Node.js, Python, PHP, Java, Go, Rust, and Ruby | npx skills add Quality-Max/free-qa-skills/dependency-audit |
| dead-code-scan | Unused exports, unreferenced files, unreachable branches, unused imports | npx skills add Quality-Max/free-qa-skills/dead-code-scan |
| complexity-hotspots | Long functions, deep nesting, high cyclomatic complexity, god-files — ranked worst-first | npx skills add Quality-Max/free-qa-skills/complexity-hotspots |
| error-handling-audit | Swallowed exceptions, bare catches, floating promises, missing timeouts/retries | npx skills add Quality-Max/free-qa-skills/error-handling-audit |
Test review (local repository — no MCP)
| Skill | What It Checks | Install |
|---|
| test-quality-review | Assertion-free tests, weak assertions, skipped/only tests, over-mocking, missing edge cases | npx skills add Quality-Max/free-qa-skills/test-quality-review |
| script-quality-review | Generated tests whose green run is a skip, a status-only 4xx, a missed case, an unknown route or selector, or a write with no undo | npx skills add Quality-Max/free-qa-skills/script-quality-review |
| flaky-selector-scan | Brittle UI locators (nth-child, absolute XPath, generated classes) → stable role/data-test suggestions | npx skills add Quality-Max/free-qa-skills/flaky-selector-scan |
Naughty strings (browser automation or local repository)
Inspired by the Big List of Naughty Strings. Every other form check asks "does it accept garbage?" — these also ask "does it reject real people?" mr-null and scunthorpe-check are test skills: in website mode they type each case into the real form, submit it, and check the client, the server, and the saved value, so run them against a test or staging environment.
| Skill | What It Checks | Install |
|---|
| mr-null | Literal null/undefined/None/__proto__/NO treated as missing or as a keyword, 1E02/0x10/-0 silently coerced, big IDs losing precision, "Hello, undefined" leaks | npx skills add Quality-Max/free-qa-skills/mr-null |
| scunthorpe-check | Real people rejected: O'Brien, José, 李, mononyms, a+tag@ emails, foreign phones/postcodes, passphrases, profanity filters blocking Scunthorpe | npx skills add Quality-Max/free-qa-skills/scunthorpe-check |
| invisible-ink | Trojan Source bidi controls, homoglyph identifiers, zero-width and filler characters, hidden tag-character text in prompts and agent files, terminal escapes | npx skills add Quality-Max/free-qa-skills/invisible-ink |
Security & compliance (repository + optional browser automation)
| Skill | What It Checks | Install |
|---|
| security-audit | Unified quick, repository, web, full, advisory, threat-watch, or Railway review with deduplicated evidence and explicit coverage gaps | npx skills add Quality-Max/free-qa-skills/security-audit |
| security-advisory-triage | CVEs and security claims — authoritative affected/fixed versions, real asset identity, prerequisites, exposure vs. compromise | npx skills add Quality-Max/free-qa-skills/security-advisory-triage |
| exploited-vulnerability-watch | Newly exploited vulnerabilities — dated CISA KEV/vendor evidence correlated to the reviewed technology inventory | npx skills add Quality-Max/free-qa-skills/exploited-vulnerability-watch |
| railway-exposure-audit | Railway public domains, TCP proxies, private networking, service bindings, and application trust boundaries | npx skills add Quality-Max/free-qa-skills/railway-exposure-audit |
| agentic-app-risk-review | LLM/agent apps — prompt injection, unsafe tool calls, excessive agency, PII/secret leakage (OWASP-LLM-style) | npx skills add Quality-Max/free-qa-skills/agentic-app-risk-review |
| iac-misconfig-scan | Dockerfiles, Compose, Terraform, GitHub Actions — root containers, world-writable files, unpinned actions, hardcoded secrets | npx skills add Quality-Max/free-qa-skills/iac-misconfig-scan |
| api-security-scan | REST / OpenAPI — missing auth, broken object-level authorization (IDOR/BOLA), no rate limiting, verbose errors | npx skills add Quality-Max/free-qa-skills/api-security-scan |
| license-compliance-scan | Dependency licenses vs. your project's — copyleft conflicts, AGPL, unknown/unlicensed packages | npx skills add Quality-Max/free-qa-skills/license-compliance-scan |
Security Pack
Start with /security-audit when you want one security report or are unsure which focused check applies. It selects a quick, repository, web, full, advisory, threat-watch, or Railway profile and coordinates the relevant focused skills without changing the target.
The pack covers repository failure paths, changed code, secrets, multi-ecosystem dependencies and runtimes, APIs, infrastructure-as-code, Railway networking, agentic applications, HTTP headers, mixed content, browser privacy, advisory applicability, and current exploited-vulnerability monitoring. /security-advisory-triage verifies a specific CVE or security post; /exploited-vulnerability-watch starts from dated CISA KEV and vendor evidence and correlates new threats to the reviewed inventory; /railway-exposure-audit maps domains, TCP proxies, private paths, and application controls without dumping provider configuration. Each keeps exposure distinct from evidence of compromise.
Requirements
- An AI coding agent supported by the skills CLI
- A browser-automation integration such as Playwright MCP — only for web and performance checks. Advisory triage, exploited-vulnerability monitoring, dependency freshness, and lifecycle checks need current web access to public authoritative sources; repository-only checks need no MCP.
How It Works
Web skills use the agent's browser-automation integration to navigate your site, run checks in the browser, and produce a graded report. Code-review skills read your repo and git diff directly. All are diagnostic only — they find problems, they don't fix them.
Want More?
These skills find issues. QualityMax fixes them — AI-generated test automation, self-healing scripts, CI/CD quality gates.
Connect your agent to QualityMax MCP for 67 OAuth-protected tools: test generation, AI code review, BOLA scanning, k6 load testing, and breach triage.
Open QualityMax MCP on Smithery, connect it to your agent, and complete the hosted OAuth authorization flow. No API token needs to be copied into client configuration.
Security & contributing
Every skill is diagnostic — it finds and grades problems, it never changes your code, and it doesn't exfiltrate data. All skills are read-only except the two naughty-string test skills, which submit test cases to the forms of the test environment you point them at (see SECURITY.md). This read-only contract is enforced in CI by scripts/validate-skills.mjs.
License
Apache 2.0, except the adapted evidence-code-audit
files, which retain their upstream MIT license.
See the skill's provenance.
